dead hermes? corrupted radio? Post comments here - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

This is becoming a common issue and there are a lot of people with a bricked Hermes devices, usually because of a WinXP crash, bad USB port, USB hub or pulled USB cable while flashing.
This thread is in the aim of finding a solution to all these common problems: if you are the owner of a bricked hermes, please post your comments here instead of opening a new thread.
There seems to be 3 types of bricked (or dead) hermes devices:
Type 1 bricks: Corrupted radio area: No GSM, No CID, no IMEI
Usual reason for that is flashing whent wrong when RUU was flashing the radio stack (GSM.nb). Other reason can be that you flashed radio from another device (universal unlocker run on hermes, for example).
Within the type 1 bricks, there seem to be two variants:
Type 1a:devices which can boot windows mobile but can't use the phone functions.
Type 1b: devices which can't boot windows mobile and are stuck while booting, see also type 2 bricks below.
Type 2 bricks: Stuck in boot process
Usual reason for that is that flashing went wrong when the RUU was flashing any rom part different than IPL and SPL. Symptoms can vary depending on which is the ROM part affected. The most common is OS because it is the bigger part. Radio is the second most common.
Type 2a: When the phone boots, it goes directly to bootloader mode (tri-color screen)
Type 2b: When the phone boots, it stays in subslpash screen (htc or operator logo)
Type 2c: When the phone boots, it doesn't pass the windows mobile logo
Hybrid Bricks: combinations of both type 1 and type 2 bricks
These usually have a corrupted radio and are stuck in bootloader, unfortunately these are very common too, and the most dificult to repair.​
We made a wiki page long time ago whith the solutions that have worked for some people to fix bricks, unfotunately these solutions do not work for everyone, some devices are more bricked than others
First thing you have to do is visit this wiki page and follow the process explained: Common upgrade problems
If you can't repair your brick after following the process, please provide a USB monitor capture in ANSI text format (this is explained on the wiki page too) as this is the only thing that can give us a real idea on what your exact problem is. Please don't come crying and say "help me" because we can't help you if you don't provide useful information, you are in front of a big problem and you will have to loose some hours reading and experimenting before repairing your brick. If you are not willing to loose some hours reading, go and send the device to the service centre for a repair as it is the only valid solution most of the times.
Hopefully after research of everyone in this thread we can find new solutions for some of the bricks
EDIT: Please use axiom's comment below as a template for your comment and attach USB monitor capture: If your bootloader is 1.04 attach capture when trying to flash an extracted radio ROM and when trying to flash a shipped rom update. If your bootloader is 1.06 or 1.09 only attach the usb monitor capture of the shipped update.
EDIT (2007-03-22):
After more than 3 months since this thread started and more than 660 comments, we have now solutions for some bricks, so I compiled the most common on this unbricking guide:
How to unbrick your bricked hermes​
Please spend some time reading through the wiki and thread comments before posting desesperately, otherwise you'll get no answer.​

---

The following info may help in isolating the problem and keeping the clutter down.:
I'm including my info.
Model: O2 XDA Trion
ROM Before Flash: Dopod 1.23.707.4
Radio Before Flash: 1.16
Bootloader Before Flash: 1.04
Flash failed at: 6%
Flashing ROM: 1.35.255.2
Flashing Radio: 1.18.00.10
Bootloader After Failure: 1.09
CID Before Failure Super CID: Yes
CID Corrupt: Yes
Radio Corrupt: Yes
No GSM Error: Yes
Stuck In Bootloader: No
Stuck On Windows Mobile Splash: Yes
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>
Current Device Status: unusable

---

Hi, I've managed to brick my Hermes as well.. First time on any of my HTC Devices....
Model: Vodafone v1605
ROM Before Flash: Voda Launch ROM
Radio Before Flash: Not sure
Bootloader Before Flash: 1.04
Flash failed at: 8%
Flashing ROM: 1.35.255.2
Flashing Radio: 1.18.00.10
Bootloader After Failure: 1.09
CID Before Failure Super CID: Yes
CID Corrupt: Yes
Radio Corrupt: Assume Yes
No GSM Error: Not got that far
Stuck In Bootloader: Yes
Stuck On Windows Mobile Splash: Not got that far
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: Wait interpreter timeout HTCSF kEØ(HTCEUSB>
Current Device Status: unusable

---

You may already know this, as I posted it in all over the other threads of people with bricked hermes, but I'm posting again to make sure every piece of information is concentrated on this thread, and see if finally this can get us somewhere
HTC bootloader returns data encapsulated in a block between HTCS (start) and HTCE (end), before the HTCE there's always a 4-byte checksum of the data. You're getting a timeout when you query the bootloader for the device's CID, so the output you see is "F" which means failure (T means success) encapsulated in this HTCS/HTCE block, plus the checksum. The CID is read from the security area of the device, found on radio, but the wrong flash corrupted the radio area.
As the CID is not returned, the error you get when flashing the ROM is "CID Not allow (255)". The security level depends on CID, as the device has CID corrupted, the security level returned is FF (255), which means you can't bypass CID check in bootloader.
You both have bootloader 1.09 which does enforce CID checking (as opposite to bootloader 1.04 which has a known bug to circumvent this). This bootloader also only allows updates with bootloader version > 1.09 (and no such bootloader exists yet).
Bootloader 1.04 allows to flash unsigned code in radio with radio bootloader command 'rwdata', but radio bootloader is accessed through command 'rtask' and this command has been removed in following bootloader versions.
All the commands to flash code in bootloader 1.06 and above require the code to be signed (the commands are 'wdatah' and 'lnbs'), and bootloader checks the signature before the code is actually flashed on the device. So modifying a 1.04 bootloader to show itself as 1.10 is not possible because it will return a certificate error and will not be possible to flash.
Command 'lnbs' doesn't check CID, but it is only enabled if device has security level=0, and as your radio is corrupted and your seclevel=FF it will not be possible to use this command to fix it even if you had a signed bootloader, so 'wdatah' is the only command that would allow you flashing code, but 'wdatah' requires a NBH header to be sent, which contains the CID of the update and is checked against the missing CID on your device and will never match (even if you could modify the NBH header and have a valid signature after).
In conclusion, my recommendation to you is that you send the device to service centre to get it repaired and don't try to fix this by yourselves, as you will go nowhere.

---

Many thanks for explaining it so succinctly Pof, much appreciated. With this error I've learnt a heck of a lot more about the ROM flashing process... I guess it may be time to send the unit for repair!

---

This is the full report after I soft rest my phone while the USB is still connected. Would any one know what the rest of the data means? I did it in the morning then just left it for the day to see what would happen, I just got back from work.

---

onj: can you use axiom comment as a template to provide information?
radioerror.txt: I see you're using the Himalaya upgrade utility there... rbmc reads data from memory, but I don't know what is at 0x70010000. It would be better if you can provide a log of hermes RUU.

---

Model: x01ht
ROM Before Flash: i-mate
Radio Before Flash: 1.07.03.10
Bootloader Before Flash: 1.04
Flash failed at: 0%
Flashing ROM: JASJAR_WWE_19096_19505_11300_AKU_3_2_ship
Flashing Radio: 1.13.00
Bootloader After Failure: 1.04
CID Before Failure Super CID: success
CID Corrupt: don't know
Radio Corrupt: Yes
No GSM Error: Yes
Stuck In Bootloader: No
Stuck On Windows Mobile Splash: Yes
Can boot into OS: No
Tried mtty command set 14 0: Yes
Tried wiki problem number 5: Yes
mtty info 2 output: CID: stalls
Current Device Status: unusable
I will upload the usbmonitor with using
RUU_HERMES_HTC_WWE_1[1].35.255.2_1.35.255.102_1.08.00.10_SHIP
the upgrading dies after info 3
computer says ERROR [222] Device not responding
that's with all the RUU's that I use and even the full upgrade ROM

---

Hi, I have a herm 200 an i have a Type 2a bricks (it goes directly to bootloader mode tri-color screen).
But i upgrade with the rom (ME_DT_WWE_1182553_106_10303_Ship) and all run good. but 3 moths later i have the type 2a bricks.
I try with that solution (http://wiki.xda-developers.com/index.php?pagename=Hermes_UpgradeProblems) and others and NOthing.
In screnn say herm200 ILP-1.00 and Her200 SPL-1.04.
ps: sorry my english is very bad.

---

@onj: Oh ****! You where trying to flash an HTC Universal ROM in your HTC Hermes!! These are different devices, most probably that's what screwed it.
From your attached file I see bootloader does not answer to any command.
@landtd5: please use axiom comment as a template, and attach USB monitor capture when tryng to flash a shipped rom and a radio rom.

---

Yup, I upgraded with the wrong Rom. After going through the forum for the past 2 weeks I realized what I did. I guess it's time for me to send it to the shop
thanks for you help pof

---

jash431 Dead Tytn
I had tytn with this rom
"TYTN_me_dt_wwe_1182553_106_10303_ship" which has bootloader 1.04
And I upgraded with
"RUU_HERMES_HTC_WWE_1.35.255.2_1.35.255.102_1.08.00.10_SHIP"
during upgrade stopped and after that I cannot do anything with it
It never answer to any solutions .
Please help me .
USB monitore is attached here .

---

jash431 said:
USB monitore is attached here .
Click to expand...
Click to collapse
This is not useful: You saved LGS file, please follow instructions in wiki, you need to EXPORT as ANSI TEXT file. Also please use the 1st comment as a template to provide useful information.

---

Jash431
I exported in ansi text

---

@jash431: doesn't return anything... when you connect to bootloader on mtty, do you see the USB prompt? does it answer any commands?

---

Jash431
I'm sorry . this is complete one .
yes I can work with mtty.exe and my info 2 is "HTCSF kEØ(HTCEUSB>"

---

jash431: hybrid brick with corrupted radio and bootloader 1.09. Send it to repair centre.

---

jash431
is it theorically possible to fix my tytn . I mean maybe in future someone make a downgrade or SuperCID rom !! .
Because in my country doesn't exist repair center (Iran) . So what can I do ???

---

then keep it until something is found to fix this, creative solutions to the problem will come to your mind after looking everyday at a $500 brick.

---

Jash431
Thanks pof for your answer . I'll check my private message every day , for your solution and I remember you whenever I see a 500$ . ( Of course 500$ doesn't exist but you do ).